=== DF-2383 baseline runs (HPHARNESS kernel #8, verbatim acpi_hp.c,
    fix_drain=0) — root@dfbsd over ssh; kernel-side orchestration in the
    harness worker kthread (hw.hpsim.cmd); full serial record in
    serial.baseline_runs.txt / dfbsd-qemu/boot.log ===

--- create (cmd 1) ---
HPSIM: fake acpi_wmi bus attached: acpi_wmi39
acpi_hp0: HP event GUID detected, installing event handler
HPSIM: install_event_handler: handler=0xffffffff80a177c0 ctx=0xfffff801171cb260 (dev=acpi_hp0)
acpi_hp0: HP CMI GUID detected
HPSIM: created: acpi_wmi39 + acpi_hp0 (sc=0xfffff80117b50e80)

--- CONTROL (cmd 5): no in-flight notify; expect victim untouched ---
HPSIM: teardown: device_delete_child -> real acpi_hp_detach + newbus kfree(softc, M_BUS) [kldunload path] sc=0xfffff80117b50e80 size=1208
acpi_hp0: detached
HPSIM: victim spray: victim=0xfffff80117b50e80 old_sc=0xfffff80117b50e80 hit=1
HPSIM: control victim diff: 0 changed byte(s), 0 at known softc field(s); victim==old_sc YES
hw.hpsim.uaf_writes = 0

--- UAF (cmd 4) run 1/3: notify stalled mid-handler, teardown underneath,
    freed chunk reclaimed as victim, handler released ---
HPSIM: dispatch: calling handler 0xffffffff80a177c0(ctx=0xfffff801171cb300) AFTER lock release
HPSIM: stall: handler parked mid-acpi_hp_notify
HPSIM: scenario uaf: handler confirmed stalled inside acpi_hp_notify; running detach+free underneath it
HPSIM: teardown: device_delete_child -> real acpi_hp_detach + newbus kfree(softc, M_BUS) [kldunload path] sc=0xfffff80117b52280 size=1208
acpi_hp0: detached
HPSIM: victim spray: victim=0xfffff80117b52280 old_sc=0xfffff80117b52280 hit=1
HPSIM: watchdog: stalled handler auto-released into (possibly freed) softc
HPSIM: uaf victim WRITE at softc+56 (field was_wlan_on_air): 0x00 -> 0x01
HPSIM: uaf victim diff: 1 changed byte(s), 1 at known softc field(s); victim==old_sc YES
HPSIM: RESULT: UAF WRITE CONFIRMED on freed softc (1 field write(s))
hw.hpsim.uaf_writes = 1

--- UAF runs 2/3 and 3/3: identical result (deterministic) ---
HPSIM: uaf victim WRITE at softc+56 (field was_wlan_on_air): 0x00 -> 0x01
HPSIM: RESULT: UAF WRITE CONFIRMED on freed softc (1 field write(s))
HPSIM: uaf victim WRITE at softc+56 (field was_wlan_on_air): 0x00 -> 0x01
HPSIM: RESULT: UAF WRITE CONFIRMED on freed softc (1 field write(s))

--- live-path sanity: verbose print through the REAL evaluate path ---
(root) sysctl hw.acpi.hp.verbose=1; sysctl hw.acpi.hp.wlan_enable_if_radio_on=1
acpi_wmi39: Wireless status is 100

--- DELAYED (cmd 6): handler copied under WMI lock, invocation 2s late,
    teardown during the delay -> baseline PANICS inside the real
    acpi_hp_notify (see panic.txt for the full block) ---
HPSIM: scenario delayed: dispatch armed with 2s delay; teardown NOW (handler copied but not yet invoked)
HPSIM: teardown: device_delete_child -> ... sc=0xfffff80117b50980 size=1208
acpi_hp0: detached
HPSIM: victim spray: victim=0xfffff80117b50980 old_sc=0xfffff80117b50980 hit=1
HPSIM: dispatch: calling handler 0xffffffff80a177c0(ctx=0xfffff801171cb4e0) AFTER lock release
Fatal trap 12: page fault while in kernel mode
fault virtual address	= 0x8
instruction pointer	= 0x8:0xffffffff80a177e7
panic: page fault
acpi_hp_notify() at acpi_hp_notify+0x27 0xffffffff80a177e7
hp_sim_inject_thread() at hp_sim_inject_thread+0xa6 0xffffffff80a82306

=== DF-2383 fixed-kernel runs (HPHARNESS kernel #11: fix.diff applied
    [acpi_hp.c wrong-device remove + acpi_wmi.c drain] + HP_SIM_FIX_DRAIN=1
    in the harness mirroring the acpi_wmi.c hunk) ===

--- CONTROL (cmd 5) ---
HPSIM: control victim diff: 0 changed byte(s), 0 at known softc field(s); victim==old_sc YES
hw.hpsim.uaf_writes = 0

--- UAF (cmd 4) x3: the FIXED detach now calls REMOVE on sc->wmi_dev;
    the remove DRAINS the in-flight dispatch before returning, so the
    stalled handler finishes on the LIVE softc before the newbus free ---
HPSIM: stall: handler parked mid-acpi_hp_notify
HPSIM: teardown: device_delete_child -> real acpi_hp_detach + newbus kfree(softc, M_BUS) [kldunload path] sc=0xfffff80117bc9b80 size=1208
HPSIM: remove_event_handler: removed (drain=1)
HPSIM: watchdog: stalled handler auto-released into (possibly freed) softc
HPSIM: uaf victim diff: 0 changed byte(s), 0 at known softc field(s); victim==old_sc YES
HPSIM: RESULT: no post-free writes (handler drained before free?)
hw.hpsim.uaf_writes = 0   (3/3 runs)

--- DELAYED (cmd 6): teardown blocks inside the drained remove until the
    2s-late handler completed; NO panic (baseline: acpi_hp_notify panic) ---
HPSIM: scenario delayed: dispatch armed with 2s delay; teardown NOW (handler copied but not yet invoked)
HPSIM: teardown: device_delete_child -> ... sc=0xfffff80117bcaa80 size=1208
HPSIM: dispatch: calling handler 0xffffffff80a177c0(ctx=0xfffff801172ada60) AFTER lock release
HPSIM: remove_event_handler: removed (drain=1)
HPSIM: victim spray: victim=0xfffff80117bcaa80 old_sc=0xfffff80117bcaa80 hit=1
HPSIM: delayed victim diff: 0 changed byte(s), 0 at known softc field(s); victim==old_sc YES
GUEST-STILL-UP